The Processes of Insider Threat Analysis
• SEI Report
Publisher
Software Engineering Institute
Abstract
Insider threat analysis comes in many shapes and forms, each with its own use cases, prerequisites, and pros and cons. The purpose of this paper is to lay out a framework that will help organizations understand and examine different analytical techniques, applications, and use cases so they can select and apply the most effective methods to improve their capabilities for analysis. The first section of this paper outlines various process constructs that you can apply to insider threat analysis. In the second section, we discuss the process of collecting data and analyzing it to get observables. The second section also covers how to obtain indicators from observables and behaviors from indicators. The third section examines how these concepts apply to several common insider threat analysis goals. Finally, the last section discusses how to measure the effectiveness of the insider threat analysis you use at your organization.
Cite This SEI Report
Horneman, A., Ditmore, B., & Spooner, D. (2021, March 12). The Processes of Insider Threat Analysis. Retrieved September 12, 2026, from https://www.sei.cmu.edu/library/the-processes-of-insider-threat-analysis/.
@techreport{horneman_2021,
author={Horneman, Angela and Ditmore, Bob and Spooner, Derrick},
title={The Processes of Insider Threat Analysis},
month={Mar},
year={2021},
institution={Software Engineering Institute, Carnegie Mellon University},
url={https://www.sei.cmu.edu/library/the-processes-of-insider-threat-analysis/},
note={Accessed: 2026-Sep-12}
}
Horneman, Angela, Bob Ditmore, and Derrick Spooner. "The Processes of Insider Threat Analysis." Software Engineering Institute, Carnegie Mellon University. Software Engineering Institute, March 12, 2021. https://www.sei.cmu.edu/library/the-processes-of-insider-threat-analysis/.
A. Horneman, B. Ditmore, and D. Spooner, "The Processes of Insider Threat Analysis," Software Engineering Institute, Carnegie Mellon University. Software Engineering Institute, 12-Mar-2021 [Online]. Available: https://www.sei.cmu.edu/library/the-processes-of-insider-threat-analysis/. [Accessed: 12-Sep-2026].
Horneman, Angela, Bob Ditmore, and Derrick Spooner. "The Processes of Insider Threat Analysis." Software Engineering Institute, Carnegie Mellon University, Software Engineering Institute, 12 Mar. 2021. https://www.sei.cmu.edu/library/the-processes-of-insider-threat-analysis/. Accessed 12 Sep. 2026.
Horneman, Angela; Ditmore, Bob; & Spooner, Derrick. The Processes of Insider Threat Analysis. Software Engineering Institute. 2021. https://www.sei.cmu.edu/library/the-processes-of-insider-threat-analysis/